Consent, records and the rules that outlive your list

This is an engineering summary, not legal advice. The point is what to build, because the obligations are mostly satisfied by recording things you should be recording anyway.

Transactional is treated differently

Across most regimes, a message sent because the recipient did something — a receipt, a password reset, a shipping notice — is not marketing and does not need marketing consent.

The protection is lost the moment the message carries promotional content. A receipt with a product recommendation in it is, in several jurisdictions, a marketing message wearing a receipt. Keeping the streams clean is a legal position as well as a deliverability one.

What the regimes ask

GDPR (EU/EEA) needs a lawful basis. For marketing that is usually consent — freely given, specific, informed, unambiguous, and demonstrable. Pre-ticked boxes do not qualify. Legitimate interest can apply in narrow cases and requires a documented assessment.

PECR (UK) governs electronic marketing specifically and is stricter than GDPR on the mechanics. The "soft opt-in" permits marketing to existing customers about similar products, provided they were given a refusal option at collection and in every message.

CAN-SPAM (US) does not require prior consent. It requires accurate headers and subject lines, a physical postal address, a working opt-out, and honouring it within ten business days.

CASL (Canada) requires consent, expressed or implied, with implied consent expiring — typically two years after a transaction.

What that means you build

Record consent at the point of collection. Timestamp, IP address, the form or source, and the exact wording shown. "Demonstrable" means you can produce this, years later, for one address.

Use confirmed opt-in. Not strictly required everywhere; it is the cleanest evidence that exists, and it protects against someone entering an address that is not theirs — which is also how pristine spam traps get onto lists.

Make opt-out one action. A working unsubscribe in every marketing message, honoured without a login. The major providers require this within two days regardless of what the law allows, so the stricter deadline is the operative one.

Keep the suppression record after deletion. This looks like a contradiction — erasure versus retention — and it is not. Retaining the minimum needed to honour an opt-out is the standard reading. Keep a hash of the address and the opt-out date, not the profile.

Expire implied consent. Where it has a clock, implement the clock.

Records are the deliverable

The common thread is evidence. For any address on your list you should be able to say where it came from, when, under what wording, and what the recipient has asked for since.

That record is what answers a regulator, and it is also what answers a blocklist operator asking how an address reached your list. The same log serves both.

Where this intersects with delivery

Lists built with real consent complain less. Complaint rate is the number mailbox providers act on, so the compliance work and the deliverability work point the same way — which is unusual enough to be worth noticing.